INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

ClickFix Loader via jsDelivr Hosts LunexStealer Malware to Websites

| 2026-10-20 20:10 LOW HIGH MALWARE & BOTNETS PHISHING & SOCIAL ENGINEERING
JSON
Executive Summary
AI-generated
Over 100 hacked websites used fake Cloudflare checks to trick visitors into installing LunexStealer through ClickFix commands. The lure is the now-familiar ClickFix technique, dressed up as Cloudflare’s standard bot check. The fake page asks you to run a command, supposedly to confirm you’re not a bot, and that command quietly downloads and installs an MSI package from an attacker-controlled server. There’s no bot to fool here, you’re the one being fooled. “In September 2026, CERT-UA specialists discovered over 100 compromised websites to which malicious JavaScript code had been added by attackers.
Technical Mitigations AI-generated
• Apply the vendor fix for CVE-2023-20598 and treat internet-facing systems that were not patched in time as potentially compromised until verified.
Technical Observables 40 IoCs Login Required
Indicators of Compromise (IoCs) Protected

Raw threat telemetry, malicious IP addresses, file hashes, and direct VirusTotal correlation are restricted to authenticated users.

Sign In to View 40 IoCs Create Free Account
domains 24 files 2 ips 3 sha1 2 urls 5 sha256 2 md5 2
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
CVE-2023-20598CVE-2023-20598
Target & Sectors
DACH DACH BENELUX BENELUX NORTH_AMERICA NORTH_AMERICA retailretail cryptocurrencycryptocurrency
Incident Timeline
‎July 9
Pivoting from that panel turned up 13 more on July 9, and by late August Sekoia's list of hosts serving the panel ran to about 80.
general_metric 13 countries
Pivoting from that panel turned up 13 more on July 9, and by late August Sekoia's list of hosts serving the panel ran to about 80.
‎September 2026
“In September 2026, CERT-UA specialists discovered over 100 compromised websites to which malicious JavaScript code had been added by attackers.
attribution CERT-UA
Ukraine’s Computer Emergency Response Team, CERT-UA, identified the campaign in September 2026 and tracks its unidentified operators as UAC-0277.
“In September 2026, CERT-UA specialists discovered over 100 compromised websites to which malicious JavaScript code had been added by attackers.
source_region Ukraine
Ukraine’s Computer Emergency Response Team, CERT-UA, identified the campaign in September 2026 and tracks its unidentified operators as UAC-0277.
organisation Ukraine’s Computer Emergency Response Team
Ukraine’s Computer Emergency Response Team, CERT-UA, identified the campaign in September 2026 and tracks its unidentified operators as UAC-0277.
tactic T1059.007 - JavaScript
“In September 2026, CERT-UA specialists discovered over 100 compromised websites to which malicious JavaScript code had been added by attackers.
general_metric 100 legitimate websites
“In September 2026, CERT-UA specialists discovered over 100 compromised websites to which malicious JavaScript code had been added by attackers.
‎September 9, 2026
The ClickFix command, for its part, retrieves an MSI installer ("elita.msi") hosted on "uasputnik[.]com," a domain that was registered on September 9, 2026.
industry Retail
General Document Context
industry Cryptocurrency
General Document Context
organisation MSI
The ClickFix command, for its part, retrieves an MSI installer ("elita.msi") hosted on "uasputnik[.]com," a domain that was registered on September 9, 2026.
observable elita.msi
The ClickFix command, for its part, retrieves an MSI installer ("elita.msi") hosted on "uasputnik[.]com," a domain that was registered on September 9, 2026.
‎September 21
According to a technical write-up published by Sekoia's Threat Detection & Research team on September 21, telemetry from multiple customer environments showed hosts communicating with Exvicy command-and-control (C2) servers.
organisation Sekoia's Threat Detection & Research
According to a technical write-up published by Sekoia's Threat Detection & Research team on September 21, telemetry from multiple customer environments showed hosts communicating with Exvicy command-and-control (C2) servers.
‎17–18 October 2026
A ClickFix campaign observed on 16 compromised WordPress sites on 17–18 October 2026 used an EtherHiding delivery chain.
organisation EdgeUpdate - Unpacking
From Win+X to EdgeUpdate - Unpacking a jsDelivr Hosted ClickFix Loader.. A ClickFix campaign observed on 16 compromised WordPress sites on 17–18 October 2026 used an EtherHiding delivery chain.
organisation ClickFix
From Win+X to EdgeUpdate - Unpacking a jsDelivr Hosted ClickFix Loader.. A ClickFix campaign observed on 16 compromised WordPress sites on 17–18 October 2026 used an EtherHiding delivery chain.
organisation WordPress
From Win+X to EdgeUpdate - Unpacking a jsDelivr Hosted ClickFix Loader.. A ClickFix campaign observed on 16 compromised WordPress sites on 17–18 October 2026 used an EtherHiding delivery chain.
organisation EtherHiding
From Win+X to EdgeUpdate - Unpacking a jsDelivr Hosted ClickFix Loader.. A ClickFix campaign observed on 16 compromised WordPress sites on 17–18 October 2026 used an EtherHiding delivery chain.
general_metric 16 compromised WordPress sites
From Win+X to EdgeUpdate - Unpacking a jsDelivr Hosted ClickFix Loader.. A ClickFix campaign observed on 16 compromised WordPress sites on 17–18 October 2026 used an EtherHiding delivery chain.
‎2026/10/20
Threat actors used a jsDelivr hosted ClickFix loader to deliver the Psychedelic Stealer malware, which combines credential theft with persistent agent capabilities.
infrastructure Windows
More than 100 legitimate websites in Ukraine were compromised and modified to display fake Cloudflare verification pages that installed information-stealing (infostealer) malware on Windows computers.
The instructions asked the user to open the Windows Run dialog, Command Prompt or PowerShell and execute a supplied command.
For context, legitimate Cloudflare verification pages do not ask visitors to open Windows tools or execute commands.
organisation Cloudflare
More than 100 legitimate websites in Ukraine were compromised and modified to display fake Cloudflare verification pages that installed information-stealing (infostealer) malware on Windows computers.
Visitors to those sites were shown a fake Cloudflare verification page that told them to copy and run a command in PowerShell, a Windows command-line tool, to prove they were human.
Over 100 hacked websites used fake Cloudflare checks to trick visitors into installing LunexStealer through ClickFix commands.
organisation ClickFix
The ClickFix chain convinced victims to manually execute msiexec.exe commands via the Windows Run dialog, achieving a 14 percent completion rate (79 infections from 426 clicks).
One of the compromised Ukrainian websites, with injected JavaScript loading the malicious ClickFix page highlighted in the browser inspector.
Over 100 hacked websites used fake Cloudflare checks to trick visitors into installing LunexStealer through ClickFix commands.
organisation Microsoft Office
Malicious Browser Extension Maintains Access Some Lunex infections deploy a Chromium extension called LunarAxe, disguised as “Microsoft Office Word Editor.”
Depending on what configuration it pulls from its command server, it can also install a browser extension called LUNARAXE, disguised under the name “Microsoft Office Word Editor” so it blends into a list of legitimate-looking add-ons.
“Depending on the configuration received from the control server, LUNEXSTEALER can install a malicious browser extension called LUNARAXE, which appears in the browser under the name “Microsoft Office Word Editor”.” continues the report.
organisation Microsoft
Ontinue found that the loader downloaded debugging information for the computer’s Windows version from Microsoft’s legitimate symbol server.
The technique deliberately avoids encoded PowerShell, using signed Microsoft binaries to bypass common ClickFix detections.
The process then proceeds to configure broad Microsoft Defender exclusions and fetch and execute two additional payloads using different methods - RemotePanel, which is written to disk, installed as a service, and is used for persistent remote access and operator control through interactive PowerShell sessions, file and process management, screen streaming, and modular hidden virtual network…
organisation Chromium
The 64-bit Windows executable is Psychedelic Stealer, which performs the following functions - Collect credentials from Chromium-based browsers, including Google Chrome, Microsoft Edge, Brave, Opera, Opera GX, Vivaldi, and Yandex, and exfiltrate them through the "/api/v1/ext/passwords" endpoint Collect browser-associated account tokens and exfiltrate them through the "/api/v1/ext/tokens" e…
In some cases, Lunex installs a malicious extension for Chromium-based browsers called LunarAxe, which disguises itself as “Microsoft Office Word Editor.”
Lunex Steals Browser and Wallet Data Once installed, Lunex can collect passwords, authentication tokens, cookies, payment-card details and autofill information from seven Chromium-based browsers: Brave Opera Vivaldi Opera GX Google Chrome Microsoft Edge Yandex Browser
organisation Google Chrome
The 64-bit Windows executable is Psychedelic Stealer, which performs the following functions - Collect credentials from Chromium-based browsers, including Google Chrome, Microsoft Edge, Brave, Opera, Opera GX, Vivaldi, and Yandex, and exfiltrate them through the "/api/v1/ext/passwords" endpoint Collect browser-associated account tokens and exfiltrate them through the "/api/v1/ext/tokens" e…
Lunex Steals Browser and Wallet Data Once installed, Lunex can collect passwords, authentication tokens, cookies, payment-card details and autofill information from seven Chromium-based browsers: Brave Opera Vivaldi Opera GX Google Chrome Microsoft Edge Yandex Browser
Ontinue found that Lunex targets seven Chromium-based browsers, including Google Chrome, Microsoft Edge, Brave, Yandex Browser, Opera, Opera GX and Vivaldi, and can steal cryptocurrency wallets and other sensitive information.
organisation Opera GX
Lunex Steals Browser and Wallet Data Once installed, Lunex can collect passwords, authentication tokens, cookies, payment-card details and autofill information from seven Chromium-based browsers: Brave Opera Vivaldi Opera GX Google Chrome Microsoft Edge Yandex Browser
Ontinue found that Lunex targets seven Chromium-based browsers, including Google Chrome, Microsoft Edge, Brave, Yandex Browser, Opera, Opera GX and Vivaldi, and can steal cryptocurrency wallets and other sensitive information.
…4-bit Windows executable is Psychedelic Stealer, which performs the following functions - Collect credentials from Chromium-based browsers, including Google Chrome, Microsoft Edge, Brave, Opera, Opera GX, Vivaldi, and Yandex, and exfiltrate them through the "/api/v1/ext/passwords" endpoint Collect browser-associated account tokens and exfiltrate them through the "/api/v1/ext/tokens" endpoi…
organisation CVE-2023-20598
The second is more elaborate, trying to slip past Windows User Account Control, carving out Microsoft Defender exceptions, and deploying a vulnerable AMD driver to exploit CVE-2023-20598, a bring-your-own-vulnerable-driver ( BYOVD ) move that blinds security tools before the real payload drops.
Vulnerable AMD Driver Used Against Security Software The Lunex chain examined by Ontinue used a legitimate but vulnerable AMD driver associated with CVE-2023-20598 .
organisation AMD
The second is more elaborate, trying to slip past Windows User Account Control, carving out Microsoft Defender exceptions, and deploying a vulnerable AMD driver to exploit CVE-2023-20598, a bring-your-own-vulnerable-driver ( BYOVD ) move that blinds security tools before the real payload drops.
Vulnerable AMD Driver Used Against Security Software The Lunex chain examined by Ontinue used a legitimate but vulnerable AMD driver associated with CVE-2023-20598 .
organisation Microsoft Defender
The second is more elaborate, trying to slip past Windows User Account Control, carving out Microsoft Defender exceptions, and deploying a vulnerable AMD driver to exploit CVE-2023-20598, a bring-your-own-vulnerable-driver ( BYOVD ) move that blinds security tools before the real payload drops.
Its target list included components associated with Microsoft Defender, Kaspersky, Dr.Web, ESET, Elastic, CrowdStrike, SentinelOne and Sysinternals.
organisation LUNEXSTEALER
Over 100 hacked websites used fake Cloudflare checks to trick visitors into installing LunexStealer through ClickFix commands.
“Depending on the configuration received from the control server, LUNEXSTEALER can install a malicious browser extension called LUNARAXE, which appears in the browser under the name “Microsoft Office Word Editor”.” continues the report.
organisation Trust Wallet
Targeting focused overwhelmingly on Ukraine with clear financial motivation, collecting browser credentials, session tokens, and cryptocurrency wallet data from MetaMask, Trust Wallet, Exodus, Atomic Wallet, and others.
…ext/passwords" endpoint Collect browser-associated account tokens and exfiltrate them through the "/api/v1/ext/tokens" endpoint Scan for known cryptocurrency wallet browser extensions (MetaMask, Trust Wallet, OKX Wallet, and SafePal) and desktop apps (Exodus, Atomic Wallet, Electrum, Bitcoin Core, and Litecoin Core) and exfiltrate data through the "/api/v1/ext/wallets" endpoint Capture ext…
organisation Lunex
The researchers said Lunex was developed by a Russian-speaking developer or team and is sold to multiple independent cybercriminal operators.
Attack chain (Image via Ontinue) Researchers identified 28 Lunex control panels hosted in 13 countries.
organisation LunarAxe
Malicious Browser Extension Maintains Access Some Lunex infections deploy a Chromium extension called LunarAxe, disguised as “Microsoft Office Word Editor.”
In some cases, Lunex installs a malicious extension for Chromium-based browsers called LunarAxe, which disguises itself as “Microsoft Office Word Editor.”
organisation MSI
Following those instructions downloaded an MSI installer from an attacker-controlled server and installed Lunex Stealer.
The fake page asks you to run a command, supposedly to confirm you’re not a bot, and that command quietly downloads and installs an MSI package from an attacker-controlled server.
organisation CAPTCHA
The victim runs the installation command after being told it is part of a CAPTCHA or security check.
The Psychedelic Stealer: When the CAPTCHA Is the Installer.
organisation NaiveMess
LunarAxe can work with another component called NaiveMess to interact with files outside the browser.
Combined with another malicious component called NaiveMess, LunarAxe can reach beyond the browser and access the computer’s file system.
organisation Polygon
The domain used for the fake page and the script’s settings are stored in a smart contract on the Polygon or Ethereum blockchain.
The clearest technical difference is not the shortcut: ErrTraffic hides its C2 address on the Polygon blockchain, a technique known as EtherHiding , while Exvicy hardcodes two servers.
organisation Command Prompt
The instructions asked the user to open the Windows Run dialog, Command Prompt or PowerShell and execute a supplied command.
organisation Windows Run, Command Prompt
Users who encounter a website asking them to open Windows Run, Command Prompt or PowerShell should close the page without following its instructions.
organisation Windows User Account Control
The second is more elaborate, trying to slip past Windows User Account Control, carving out Microsoft Defender exceptions, and deploying a vulnerable AMD driver to exploit CVE-2023-20598, a bring-your-own-vulnerable-driver ( BYOVD ) move that blinds security tools before the real payload drops.
organisation Windows Installer
"When a visitor interacts with the page, the lure copies a Windows Installer command to the clipboard and instructs the visitor to paste it into the Windows Run dialog," Arctic Wolf Labs said in a technical report shared with The Hacker News.
organisation The Hacker News
"When a visitor interacts with the page, the lure copies a Windows Installer command to the clipboard and instructs the visitor to paste it into the Windows Run dialog," Arctic Wolf Labs said in a technical report shared with The Hacker News.
organisation Microsoft Edge, Brave,
The 64-bit Windows executable is Psychedelic Stealer, which performs the following functions - Collect credentials from Chromium-based browsers, including Google Chrome, Microsoft Edge, Brave, Opera, Opera GX, Vivaldi, and Yandex, and exfiltrate them through the "/api/v1/ext/passwords" endpoint Collect browser-associated account tokens and exfiltrate them through the "/api/v1/ext/tokens" e…
organisation RemotePanel
"RemotePanel establishes persistence by masquerading as the Windows Time service and gives operators broad control over infected systems, including PowerShell, file and process management, screen access, modular HVNC, and fleet management," researchers Nevan Beal, Sam Decker, and Andi Ursry said .
organisation Run
CERT-UA’s advice is simple: a real security check will never ask you to open the Run window, Command Prompt, or PowerShell and paste a command.
organisation EXE
It can allow the malware to run EXE, COM, BAT, CMD, MSI, and PowerShell payloads, offering the operator a way to introduce additional malware.
organisation User Account Control
The attack sequence begins with a ClickFix command that uses PowerShell to initiate a multi-stage chain, with one of the intermediate components abusing the CMSTPLUA COM object to bypass User Account Control (UAC) and gain elevated administrative privileges without prompting the user and run a privileged hidden PowerShell process.
organisation Exvicy
A new ClickFix malware-as-a-service (MaaS) framework called Exvicy has been built on code lifted from a rival service, ErrTraffic.
Tactical Metrics
Metrics
infrastructure
‎Windows
Affected Product
The overlay tracked visitors using a `cjs_id` cookie and selectively displayed a fake instruction page to non-headless Windows browsers.
The lure instructed victims to open Windows Terminal with Win+X followed by I and paste a PowerShell command.
More than 100 legitimate websites in Ukraine were compromised and modified to display fake Cloudflare verification pages that installed information-stealing (infostealer) malware on Windows computers.
The instructions asked the user to open the Windows Run dialog, Command Prompt or PowerShell and execute a supplied command.
For context, legitimate Cloudflare verification pages do not ask visitors to open Windows tools or execute commands.
This method, known as Bring Your Own Vulnerable Driver, allowed the loader to access Windows kernel memory and disable monitoring callbacks used by endpoint-security products.
Ontinue found that the loader downloaded debugging information for the computer’s Windows version from Microsoft’s legitimate symbol server.
It used that information to find the correct kernel locations for the installed Windows build before disabling security callbacks.
Users who encounter a website asking them to open Windows Run, Command Prompt or PowerShell should close the page without following its instructions.
The attack mode only targets Windows users who arrive through search engines, and it will show the fake page no more than twice within 12 hours for the same visitor.
The second is more elaborate, trying to slip past Windows User Account Control, carving out Microsoft Defender exceptions, and deploying a vulnerable AMD driver to exploit CVE-2023-20598, a bring-your-own-vulnerable-driver ( BYOVD ) move that blinds security tools before the real payload drops.
Visitors to those sites were shown a fake Cloudflare verification page that told them to copy and run a command in PowerShell, a Windows command-line tool, to prove they were human.
The ClickFix chain convinced victims to manually execute msiexec.exe commands via the Windows Run dialog, achieving a 14 percent completion rate (79 infections from 426 clicks).
"When a visitor interacts with the page, the lure copies a Windows Installer command to the clipboard and instructs the visitor to paste it into the Windows Run dialog," Arctic Wolf Labs said in a technical report shared with The Hacker News.
The ClickFix chain uses an "msiexec.exe" command to fetch a Windows MSI installer that's used to deliver the stealer malware.
"The clipboard operation occurs before the lure displays its Windows Run instructions.
" "This delay controls progression through the lure interface; it does not verify that the visitor opened Windows Run, pasted the command, or installed the payload.
The 64-bit Windows executable is Psychedelic Stealer, which performs the following functions - Collect credentials from Chromium-based browsers, including Google Chrome, Microsoft Edge, Brave, Opera, Opera GX, Vivaldi, and Yandex, and exfiltrate them through the "/api/v1/ext/passwords" endpoint Collect browser-associated account tokens and exfiltrate them through the "/api/v1/ext/tokens" e…
"RemotePanel establishes persistence by masquerading as the Windows Time service and gives operators broad control over infected systems, including PowerShell, file and process management, screen access, modular HVNC, and fleet management," researchers Nevan Beal, Sam Decker, and Andi Ursry said .
Metrics
infrastructure
‎Microsoft Office
Affected Product
Malicious Browser Extension Maintains Access Some Lunex infections deploy a Chromium extension called LunarAxe, disguised as “Microsoft Office Word Editor.”
Depending on what configuration it pulls from its command server, it can also install a browser extension called LUNARAXE, disguised under the name “Microsoft Office Word Editor” so it blends into a list of legitimate-looking add-ons.
“Depending on the configuration received from the control server, LUNEXSTEALER can install a malicious browser extension called LUNARAXE, which appears in the browser under the name “Microsoft Office Word Editor”.” continues the report.
In some cases, Lunex installs a malicious extension for Chromium-based browsers called LunarAxe, which disguises itself as “Microsoft Office Word Editor.”
Metrics
data_breach
9
September
Between September 9 and September 14, 2026, an unattributed Russian-speaking operator compromised at least six legitimate Ukrainian small-business websites to deliver a fake Cloudflare verification page.
Metrics
data_breach
14
September
Between September 9 and September 14, 2026, an unattributed Russian-speaking operator compromised at least six legitimate Ukrainian small-business websites to deliver a fake Cloudflare verification page.
Metrics
data_breach
2,026
September
Between September 9 and September 14, 2026, an unattributed Russian-speaking operator compromised at least six legitimate Ukrainian small-business websites to deliver a fake Cloudflare verification page.
Intelligence Sources
The Hacker News 2026-09-24
Infosecurity-Magazine 2026-09-21
AlienVault OTX 2026-10-20
AlienVault OTX 2026-10-02
TheRecord 2026-10-06
Security Affairs 2026-10-07
HackRead 2026-10-07